Explaining the Attributes of a Deep Learning Based Intrusion Detection System for Industrial Control Networks

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Industrial Control Systems

Background:

• Intrusion detection is crucial for industrial control systems (ICS) but current deep learning (DL) models lack interpretability.
• Simple intrusion alarms offer limited value, hindering effective decision-making by security professionals.

Purpose of the Study:

• To improve the explainability of deep neural network (DNN) models for ICS intrusion detection.
• To bridge the gap between DL model calculations and actionable security insights for professionals.

Main Methods:

• Analyzed DNN and interpretable classification models to understand their calculation and classification processes.
• Developed a layer-wise relevance propagation (LRP) method to map computational abnormalities to attribute-level anomalies.
• Designed filtering rules for low-cost datasets to enhance result accuracy.

Main Results:

• Identified specific abnormalities in DNN calculations by comparing normal and abnormal samples.
• Successfully mapped computational anomalies to attribute abnormalities using LRP.
• Demonstrated that filtering rules improve the accuracy of intrusion detection results.

Conclusions:

• The developed LRP method enhances the interpretability of DNN-based intrusion detection for ICS.
• Improved explainability allows security professionals to more rapidly detect and respond to cyber threats.
• This approach makes DL methods more applicable and valuable for ICS cybersecurity.